RFP Attachment 2 - IA RMF IDIQ Labor Categories_v1_04-16-2024.xlsx

General Information

Because of the specialized skills required for highly adaptive cybersecurity work, experience is often substituted for degree or degree for experience as shown in the substitution table. All experience and education shall be in a technical field related to the labor category being proposed and degrees will be from accredited institutions.

substituted for an Associate’s Degree Bachelor's 4 year’s work experience may be substituted for a Bachelor’s Degree Associate’s Degree plus 2 years work experience may be substituted for a Bachelor’s Degree

substituted for a Doctorate

Baseline Certifications

Approved Baseline Certifications (8570.01M) Reference Site: https://public.cyber.mil/wid/dod8140/dod-approved-8570-baseline-certifications/ NOTE: All of the 8570 certifications carried over to the 8140 Workforce Qualification and Management Program, so are listed here.

IAT Level I2 IAT Level II2 IAT Level III This table provides a list of DoD approved IA baseline certifications aligned to each category and level of the IA Workforce. Personnel performing IA functions must obtain one of the certifications required for their position, category/specialty and level to fulfill the IA baseline certification requirement. Most IA levels within a category or specialty have more than one approved certification and a certification may apply to more than one level.

An individual needs to obtain only one of the “approved certifications”; for his or her IA category or specialty and level to meet the minimum requirement. For example, an individual in an IAT Level II position could obtain any one of the seven certifications listed in the IAT Level II cell.

Higher level IAT and IAM certifications satisfy lower level requirements. Certifications listed in Level II or III cells can be used to qualify for Level I. However, Level I certifications cannot be used for Level II or III unless the certification is also listed in the Level II or III cell. For example:

The A+ or Network+ certification qualify only for Technical Level I and cannot be used for Technical Level II positions.

The System Security Certified Practitioner (SSCP) certification qualifies for both Technical Level I and Technical Level II. If the individual holding this certification moved from an IAT Level I to an IAT Level II position, he or she would not have to take a new certification.

Higher level CCSP and IASAE certifications do not satisfy lower level requirements

1. This category is equivalent to the CND-SP CATEGORY cited in the DoD 8570.01-M. The name was changed from CND-SP to CSSP to reflect current terminology in the DoD Instruction 8530.01 “Cybersecurity Activities Support to DoD Information Network Operations.

2. CCNA-Security was retired by Cisco, modified, and rebranded as simply “CCNA.” If you possessed the CCNA-Security and were in a position that required that certification when it was retired, you may be eligible for a waiver to cite the rebranded CCNA as a qualifying baseline certification. See the DoD CIO CCNA Security Waiver on the DoD Cyber Workforce Documents website for additional information.

** CySA+ is a CompTIA certification formerly listed as CSA+. The exam and the official name of the certification remain the same, only the acronym has changed.

*** CGRC (Certified in Governance, Risk and Compliance) is an (ISC)2 certification formerly listed as CAP (Certified Authorization Professional). Only the name of the certification has changed, and was effective February 15, 2023.

A+ CE

CCNA-Security

CND

Network+ CE SSCP CCNA-Security CySA+ **

GICSP

GSEC

Security+ CE

CND

SSCP CASP+ CE

CCNP Security

CISA

CISSP (or Associate)

GCED

GCIH

CCSP

CND

Cloud+

GSLC

Security+ CE

HCISPP CGRC***

CASP+ CE

CISM

CISSP (or Associate)

GSLC

CCISO

HCISPP CISM

CISSP (or Associate)

GSLC

CCISO

CISSP (or Associate)

CSSLP CASP+ CE

CISSP (or Associate)

CSSLP CISSP-ISSAP

CISSP-ISSEP

CCSP

CFR

CCNA Cyber Ops CCNA-Security CySA+ **

GCIA

GCIH

GICSP

Cloud+

SCYBER

PenTest+ CEH CySA+ **

GICSP

SSCP

CHFI

CFR

Cloud+

CND CEH

CFR

CCNA Cyber Ops CCNA-Security

CHFI

CySA+ **

GCFA

GCIH

SCYBER

PenTest+

CySA+ **

CISA

GSNA

CFR

PenTest CISM

CISSP-ISSMP

CCISO

Labor Categories

Core Knowledge of:

- risk management processes (e.g., methods for assessing and mitigating risk)

- national and international laws, regulations, policies, and ethics as they relate to cybersecurity

- cybersecurity principles

- cyber threats and vulnerabilities

- computer networking concepts and protocols, and network security methodologies

AND

PMP or PgMP CGRC or CASP+

AND

PMP or PgMP CCISO or CISM or CISSP or GSLC

AND

PMP or PgMP

Project Manager Serves as the central point of contact for task/delivery orders and interfaces with the Contracting Officer's Representatives for tasks. Establishes and enforces procedures to ensure that all tasks are performed in accordance with applicable standards and quality requirements. Assigns duties and reviews work of subordinates and subcontractors. Meets and confers with CG management officials regarding status of specific technical activities and progress. Resolves problems, issues or conflicts as required, and ensures that program schedules, performances, and deliverables are met. Foundational Qualifications for Project Manager: Education Associates degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Bachelor's degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Bachelor's degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Demonstrated information technology expertise and direct hands-on experience in the areas of Information Assurance, Cybersecurity, and project management; demonstrated communication skills to be able to interface with all levels of management; strong project management skills in addition to interpersonal, writing, and presentation skills; experience supervising and managing projects of at least 15 personnel, subordinate groups, and/or diverse locations.

Core Knowledge of:

- risk management processes (e.g., methods for assessing and mitigating risk)

- national and international laws, regulations, policies, and ethics as they relate to cybersecurity

- cybersecurity principles

- cyber threats and vulnerabilities

- computer networking concepts and protocols, and network security methodologies

Program Analyst Possess demonstrated knowledge and experience applying methodologies and principles to address client needs. Applies analytic techniques in the evaluation of task objectives and contributes to the implementation of strategic direction. Performs analyst functions including data gathering, interviewing, data modeling, testing, and creation of performance measurements to support objectives. Conducts activities in support of project team's objectives. Works closely with other members of the project team. Foundational Qualifications for Program Analyst: Education Associates degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Bachelor's degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Bachelor's degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Demonstrated experience supporting the implementation of the DIACAP, RMF, DCIS 6/3, NIST, ICD 505, and DODIIS requirements; demonstrated experience in analyzing and preparing program documents and reports; knowledge and capability in developing program requirements, documentation, financial, and/or technical requirements; strong writing and presentation skills; demonstrated communication skills to interface with all levels of management.

Core Knowledge of:

- risk management processes (e.g., methods for assessing and mitigating risk)

- national and international laws, regulations, policies, and ethics as they relate to cybersecurity

- cybersecurity principles

- cyber threats and vulnerabilities

- computer networking concepts and protocols, and network security methodologies

Security Control Assessor Conducts independent comprehensive assessments of the management, operational, and technical security controls and control enhancements employed within or inherited by an information technology (IT) system to determine the overall effectiveness of the controls. Foundational Qualifications for SCA: Education Associates degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Bachelor's degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Bachelor's degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Demonstrated experience in determining how a security system should work including its resilience and dependability capabilities; Demonstrated experience in discerning the protection needs of information systems, networks, and platform information technology; Demonstrated experience in applying the principles of confidentiality, integrity, and availability.

Core Knowledge of:

- risk management processes (e.g., methods for assessing and mitigating risk)

- national and international laws, regulations, policies, and ethics as they relate to cybersecurity

- cybersecurity principles

- cyber threats and vulnerabilities

- computer networking concepts and protocols, and network security methodologies

Information System Security Officer Analyzes and defines security requirements. Performs risk analysis and security contol assessment and audit services, develops analytical reports as required. May be required to perform or assist in one or more of the following areas: Risk and Vulnerability Assessments; scanning; assessment of system security for compliance of applications; security of computer network hardware; operating system utility/support software; disaster recovery; incident response; application assessment; vulnerability threat management; cloud security; contingency planning; social engineering; and the development of security procedures. Possess and apply expertise on multiple complex work assignments. Foundational Qualifications for ISSO: Education Associates degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Associates degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Bachelor's degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Demonstrated experience in discerning the protection needs of information systems, networks, and platform information technology; Demonstrated experience in applying the principles of confidentiality, integrity, and availability; Demonstrated experience implementing the RMF process especially for system categorization and control selection, implementation, and assessment, as well as continuous monitoring.

Core Knowledge of:

- risk management processes (e.g., methods for assessing and mitigating risk)

- national and international laws, regulations, policies, and ethics as they relate to cybersecurity

- cybersecurity principles

- cyber threats and vulnerabilities

- computer networking concepts and protocols, and network security methodologies

Information System Security Engineer Provides technical input, recommendations, and assistance with the implementation of both higher and granular-level cyber security approaches, methods, and solutions that incorporate and maintain compliance to requirements resulting from laws, regulations, and other pertinent guidance. May be required to perform or assist in one or more of the following areas: Risk and Vulnerability Assessments; Cyber Hunting activities; conducting scanning; assessment of system security for compliance of applications; security of computer network hardware; operating system utility/support software; disaster recovery; incident response and digital forensics; vulnerability threat management; cloud security; contingency planning; social engineering; and the development of security procedures. Possess and apply expertise on multiple complex work assignments. Foundational Qualifications for ISSE: Education Associates degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Associates degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Bachelor's degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Demonstrated experience in Information Security (INFOSEC); computer security; cryptography; network security; assessment and authorization; incident response investigations; risk analysis; threat and vulnerability scanning, analysis, and management. Demonstrated experince with system and security engineering principles such as secure architecture, design, and development, and defense in depth. Demonstrated communication skills to interface with all levels of management, as well as appropriate use of style and language for audience.

Core Knowledge of:

- risk management processes (e.g., methods for assessing and mitigating risk)

- national and international laws, regulations, policies, and ethics as they relate to cybersecurity

- cybersecurity principles

- cyber threats and vulnerabilities

- computer networking concepts and protocols, and network security methodologies

Database Specialist Provides all activites related to the administration of computerized databases. Designs, creates, administers, and maintains databases and/or data management systems that allow for the storage, query, and utilization of data. Includes maintenance of database dictionaries, overall monitoring, and integration of data feeds. Projects long-range requirements for database administration and design to meet end-user needs. Foundational Qualifications for Database Specialist: Education Associates degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Bachelor's degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Bachelor's degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Demonstrated experience in establishing data security controls, maintaining databases, and optimizing database performance.

Core Knowledge of:

- risk management processes (e.g., methods for assessing and mitigating risk)

- national and international laws, regulations, policies, and ethics as they relate to cybersecurity

- cybersecurity principles

- cyber threats and vulnerabilities

- computer networking concepts and protocols, and network security methodologies

Data Analyst Analyzes and interprets data from multiple disparate sources and builds visualizations and dashboards to report insights. Conducts quality control of databases to ensure accurate and appropriate use of data. Foundational Qualifications for Data Analyst: Education Associates degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Bachelor's degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Bachelor's degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. Demonstrated experience in the following areas: conducting queries and developing algorithms to analyze data structures; generating queries and reports; identifying data patterns/relationships; statistics and associated techniques; use of data analysis tools and writing scripts. Demonstrated communications skills to interface with all levels of management. Strong interpersonal skills to include approachability, effective listening, and appropriate use of style and language for the audience.

Core Knowledge of:

- risk management processes (e.g., methods for assessing and mitigating risk)

- national and international laws, regulations, policies, and ethics as they relate to cybersecurity

- cybersecurity principles

- cyber threats and vulnerabilities

- computer networking concepts and protocols, and network security methodologies

Technical Writer Gathers, analyzes, and composes technical information required to prepare technical and cybersecurity documentation. Writes and maintains technical documentation in support of the RMF process and cybersecurity program. Reviews content of documentation for quality and conformance with standards. Conducts research and ensures the use of proper technical terminology. Interviews technical resource personnel for content and performs content validation. Translates technical information into clear, readable documents to be used by technical and non-technical personnel. Foundational Qualifications for Technical Writer: Education Associates degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, English, or other related discipline. Associates degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, English, or other related discipline. Associates degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, English, or other related discipline. Demonstrated experience in producing and/or editing technical documentation and reports, consolidating technical input and analyses, generating a logical, understandable flow of information, and writing for technical and non-technical audiences.

Core Knowledge of:

- risk management processes (e.g., methods for assessing and mitigating risk)

- national and international laws, regulations, policies, and ethics as they relate to cybersecurity

- cybersecurity principles

- cyber threats and vulnerabilities

- computer networking concepts and protocols, and network security methodologies

Cybersecurity Subject Matter Expert Serve as a technical expert in areas relevant to a particular project. Produce and/or review substantive and/or complex technical documentation reflecting detailed knowledge of technical areas as identified in the statement of work/performance work statement. Documentation subjects include but are not limited to systems design, system architecture, feasibility studies, and system specifications. Provides insight and guidance regarding strategic, tactical, and operational cybersecurity plans. Resolves complex problems, which require an in-depth knowledge of subject matter to specialized solutions. Confers with management team and leads in the outline and development of cybersecurity strategies and solutions. Analyzes and assesses systems and architecture requirements and recommends cybersecurity solutions. Assists in developing strategic cybersecurity plans and concepts. Advises on the impact of new cybersecurity legislation, mandates, regulations, or new technologies and industry best-practices that are relevant to the USCG. Foundational Qualifications for Cybersecurity SME: Education Bachelor's degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. (no substitution for education reqmt.) Bachelor's degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. (no substitution for education reqmt.) Bachelor's degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, Computer Engineering, or other related discipline. (no substitution for education reqmt.)

Possesses requisite knowledge and expertise so recognized in the professional cybersecurity community that the individual is considered "expert" and a technical leader in the cybersecurity areas being addressed. Demonstrates exceptional oral and written communication skills.

Core Knowledge of:

- risk management processes (e.g., methods for assessing and mitigating risk)

- national and international laws, regulations, policies, and ethics as they relate to cybersecurity

- cybersecurity principles

- cyber threats and vulnerabilities

- computer networking concepts and protocols, and network security methodologies