Leadership
Develops cyberspace plans, strategy and policy to support and align with organizational cyberspace missions and initiatives.
Core KSATs
KSAT ID | Description | KSAT |
---|---|---|
22 | * Knowledge of computer networking concepts and protocols, and network security methodologies. |
Knowledge |
88A | Knowledge of current and emerging cyber technologies. |
Knowledge |
108 | * Knowledge of risk management processes (e.g., methods for assessing and mitigating risk). |
Knowledge |
282A | Knowledge of emerging technologies that have potential for exploitation by adversaries. |
Knowledge |
320A | Knowledge of external organizations and academic institutions with cyber focus (e.g., cyber curriculum/training and Research & Development). |
Knowledge |
410A | Analyze organizational cyber policy. |
Task |
424B | Assess policy needs and collaborate with stakeholders to develop policies to govern cyber activities. |
Task |
492A | Design/integrate a cyber strategy that outlines the vision, mission, and goals that align with the organization’s strategic plan. |
Task |
565A | Draft, staff, and publish cyber policy. |
Task |
720A | Monitor the rigorous application of cyber policies, principles, and practices in the delivery of planning and management services. |
Task |
812A | Provide policy guidance to cyber management, staff, and users. |
Task |
840A | Review, conduct, or participate in audits of cyber programs and projects. |
Task |
854A | Support the CIO in the formulation of cyber-related policies. |
Task |
1027A | Interpret and apply applicable laws, statutes, and regulatory documents and integrate into policy. |
Task |
1036 | Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed. |
Knowledge |
1157 | * Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity. |
Knowledge |
1158 | * Knowledge of cybersecurity principles. |
Knowledge |
1159 | * Knowledge of cyber threats and vulnerabilities. |
Knowledge |
5020 | Advocate for adequate funding for cyber training resources, to include both internal and industry-provided courses, instructors, and related materials. |
Task |
5560 | Promote awareness of cyber policy and strategy as appropriate among management and ensure sound principles are reflected in the organization’s mission, vision, and goals. |
Task |
6100 | Ability to develop policy, plans, and strategy in compliance with laws, regulations, policies, and standards in support of organizational cyber activities. |
Ability |
6140 | Ability to leverage best practices and lessons learned of external organizations and academic institutions dealing with cyber issues. |
Ability |
6270 | Knowledge of full spectrum cyber capabilities. |
Knowledge |
6900 | * Knowledge of specific operational impacts of cybersecurity lapses. |
Knowledge |
6935 | * Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS). |
Knowledge |
6938 | * Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments. |
Knowledge |
Additional KSATs
KSAT ID | Description | KSAT |
---|---|---|
105 | Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code). |
Knowledge |
244 | Ability to determine the validity of technology trend data. |
Ability |
297A | Knowledge of industry indicators useful for identifying technology trends. |
Knowledge |
336 | Knowledge of the nature and function of the relevant information structure (e.g., National Information Infrastructure). |
Knowledge |
485A | Define and integrate current and future mission environments. |
Task |
539 | Develop policy, programs, and guidelines for implementation. |
Task |
594 | Establish and maintain communication channels with stakeholders. |
Task |
724A | Seek consensus on proposed policy changes from stakeholders. |
Task |
838 | Review existing and proposed policies with stakeholders. |
Task |
847 | Serve on agency and interagency policy boards. |
Task |
942 | Knowledge of the organization’s core business/mission processes. |
Knowledge |
1125 | Knowledge of Cloud-based knowledge management technologies and concepts related to security, governance, procurement, and administration. |
Knowledge |
5300 | Ensure cyber workforce management policies and processes comply with legal and organizational requirements regarding equal opportunity, diversity, and fair hiring/employment practices. |
Task |
5620 | Review/Assess cyber workforce effectiveness to adjust skill and/or qualification standards. |
Task |
6210 | Knowledge of cloud service models and possible limitations for an incident response. |
Knowledge |
6410 | Knowledge of strategic theory and practice. |
Knowledge |
Develop cyberspace workforce plans, strategies and guidance to support cyberspace workforce manpower, personnel, training and education requirements and to address changes to cyberspace policy, doctrine, materiel, force structure, and education and training requirements.
Core KSATs
KSAT ID | Description | KSAT |
---|---|---|
22 | * Knowledge of computer networking concepts and protocols, and network security methodologies. |
Knowledge |
108 | * Knowledge of risk management processes (e.g., methods for assessing and mitigating risk). |
Knowledge |
320A | Knowledge of external organizations and academic institutions with cyber focus (e.g., cyber curriculum/training and Research & Development). |
Knowledge |
492A | Design/integrate a cyber strategy that outlines the vision, mission, and goals that align with the organization’s strategic plan. |
Task |
629A | Identify and address cyber workforce planning and management issues (e.g. recruitment, retention, and training). |
Task |
1157 | * Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity. |
Knowledge |
1158 | * Knowledge of cybersecurity principles. |
Knowledge |
1159 | * Knowledge of cyber threats and vulnerabilities. |
Knowledge |
5020 | Advocate for adequate funding for cyber training resources, to include both internal and industry-provided courses, instructors, and related materials. |
Task |
5160 | Coordinate with internal and external subject matter experts to ensure existing qualification standards reflect organizational functional requirements and meet industry standards. |
Task |
5230 | Develop and implement standardized position descriptions based on established cyber work roles. |
Task |
5250 | Develop cyber career field classification structure to include establishing career field entry requirements and other nomenclature such as codes and identifiers. |
Task |
5290 | Ensure cyber career fields are managed in accordance with organizational Human Resource (HR) policies and directives. |
Task |
5300 | Ensure cyber workforce management policies and processes comply with legal and organizational requirements regarding equal opportunity, diversity, and fair hiring/employment practices. |
Task |
5330 | Establish and collect metrics to monitor and validate cyber workforce readiness including analysis of cyber workforce data to assess the status of positions identified, filled, and filled with qualified personnel. |
Task |
5350 | Establish cyber career paths to allow career progression, deliberate development, and growth within and between cyber career fields. |
Task |
5360 | Establish manpower, personnel, and qualification data element standards to support cyber workforce management and reporting requirements. |
Task |
5370 | Establish, resource, implement, and assess cyber workforce management programs in accordance with organizational requirements. |
Task |
5590 | Review and apply cyber career field qualification standards. |
Task |
5600 | Review and apply organizational policies related to or having an effect on the cyber workforce. |
Task |
5620 | Review/Assess cyber workforce effectiveness to adjust skill and/or qualification standards. |
Task |
5630 | Support integration of qualified cyber workforce personnel into information systems lifecycle development processes. |
Task |
6040 | Ability to assess and forecast manpower requirements to meet organizational objectives. |
Ability |
6100 | Ability to develop policy, plans, and strategy in compliance with laws, regulations, policies, and standards in support of organizational cyber activities. |
Ability |
6140 | Ability to leverage best practices and lessons learned of external organizations and academic institutions dealing with cyber issues. |
Ability |
6250 | Knowledge of Workforce Framework, work roles, and associated tasks, knowledge, skills, and abilities. |
Knowledge |
6560 | Skill in developing workforce and position qualification standards. |
Skill |
6900 | * Knowledge of specific operational impacts of cybersecurity lapses. |
Knowledge |
6935 | * Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS). |
Knowledge |
6938 | * Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments. |
Knowledge |
Additional KSATs
KSAT ID | Description | KSAT |
---|---|---|
88A | Knowledge of current and emerging cyber technologies. |
Knowledge |
105 | Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code). |
Knowledge |
244A | Ability to determine the validity of workforce trend data. |
Ability |
282A | Knowledge of emerging technologies that have potential for exploitation by adversaries. |
Knowledge |
297A | Knowledge of industry indicators useful for identifying technology trends. |
Knowledge |
336 | Knowledge of the nature and function of the relevant information structure (e.g., National Information Infrastructure). |
Knowledge |
410A | Analyze organizational cyber policy. |
Task |
424B | Assess policy needs and collaborate with stakeholders to develop policies to govern cyber activities. |
Task |
485A | Define and integrate current and future mission environments. |
Task |
539 | Develop policy, programs, and guidelines for implementation. |
Task |
565A | Draft, staff, and publish cyber policy. |
Task |
594 | Establish and maintain communication channels with stakeholders. |
Task |
641 | Identify organizational policy stakeholders. |
Task |
720A | Monitor the rigorous application of cyber policies, principles, and practices in the delivery of planning and management services. |
Task |
724A | Seek consensus on proposed policy changes from stakeholders. |
Task |
812A | Provide policy guidance to cyber management, staff, and users. |
Task |
838 | Review existing and proposed policies with stakeholders. |
Task |
840A | Review, conduct, or participate in audits of cyber programs and projects. |
Task |
847 | Serve on agency and interagency policy boards. |
Task |
854A | Support the CIO in the formulation of cyber-related policies. |
Task |
942 | Knowledge of the organization’s core business/mission processes. |
Knowledge |
955B | Review and approve a supply chain security/risk management policy. |
Task |
1027A | Interpret and apply applicable laws, statutes, and regulatory documents and integrate into policy. |
Task |
1036 | Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed. |
Knowledge |
5170 | Coordinate with organizational manpower stakeholders to ensure appropriate allocation and distribution of human capital assets. |
Task |
5240 | Develop and review recruiting, hiring, and retention procedures in accordance with current Human Resource (HR) policies. |
Task |
5340 | Establish and oversee waiver processes for cyber career field entry and training qualification requirements. |
Task |
5560 | Promote awareness of cyber policy and strategy as appropriate among management and ensure sound principles are reflected in the organization’s mission, vision, and goals. |
Task |
6270 | Knowledge of full spectrum cyber capabilities. |
Knowledge |
6340 | Knowledge of organizational human resource policies, processes, and procedures. |
Knowledge |
6360 | Knowledge of organizational training and education policies, processes, and procedures. |
Knowledge |
6740 | Skill in using manpower and personnel IT systems. |
Skill |
6800 | Ability to develop career path opportunities. |
Ability |
Executes decision-making authorities and establishes vision and direction for an organization’s cyber and cyber-related policies, resources, and/or operations, while maintaining responsibility for risk-related decisions affecting mission success.
Core KSATs
KSAT ID | Description | KSAT |
---|---|---|
10 | Knowledge of application vulnerabilities. |
Knowledge |
15A | Knowledge of capabilities, applications, and potential vulnerabilities of network equipment including hubs, routers, switches, bridges, servers, transmission media, and related hardware. |
Knowledge |
22 | * Knowledge of computer networking concepts and protocols, and network security methodologies. |
Knowledge |
105 | Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code). |
Knowledge |
108 | * Knowledge of risk management processes (e.g., methods for assessing and mitigating risk). |
Knowledge |
150 | Knowledge of what constitutes a network attack and the relationship to both threats and vulnerabilities. |
Knowledge |
173 | Skill in creating policies that reflect system security objectives. |
Skill |
321A | Knowledge of industry technologies and how differences affect exploitation/vulnerabilities. |
Knowledge |
391 | Acquire and manage the necessary resources, including leadership support, financial resources, and key security personnel, to support information technology (IT) security goals and objectives and reduce overall organizational risk. |
Task |
392 | Acquire necessary resources, including financial resources, to conduct an effective enterprise continuity of operations program. |
Task |
395 | Advise senior management (e.g., CIO) on risk levels and security posture. |
Task |
396 | Advise senior management (e.g., CIO) on cost/benefit analysis of information security programs, policies, processes, and systems, and elements. |
Task |
424B | Assess policy needs and collaborate with stakeholders to develop policies to govern cyber activities. |
Task |
445 | Communicate the value of information technology (IT) security throughout all levels of the organization stakeholders. |
Task |
475 | Collaborate with stakeholders to establish the enterprise continuity of operations program, strategy, and mission assurance. |
Task |
492A | Design/integrate a cyber strategy that outlines the vision, mission, and goals that align with the organization’s strategic plan. |
Task |
524 | Develop and maintain strategic plans. |
Task |
542A | Develop mitigation strategies to address cost, schedule, performance, and security risks. |
Task |
599 | Evaluate contracts to ensure compliance with funding, legal, and program requirements. |
Task |
600 | Evaluate cost benefit, economic, and risk analysis in decision making process. |
Task |
674 | Interface with external organizations (e.g., public affairs, law enforcement, Command or Component Inspector General) to ensure appropriate and accurate dissemination of incident and other Computer Network Defense information. |
Task |
679 | Lead and align information technology (IT) security priorities with the security strategy. |
Task |
680A | Lead and oversee budget, staffing, and contracting. |
Task |
680 | Lead and oversee information security budget, staffing, and contracting. |
Task |
711 | Monitor and evaluate the effectiveness of the enterprise’s cybersecurity safeguards to ensure they provide the intended level of protection. |
Task |
737B | Perform an information security risk assessment. |
Task |
797 | Provide advice on project costs, design concepts, or design changes. |
Task |
801 | Provide enterprise cybersecurity and supply chain risk management guidance for development of the Continuity of Operations Plans. |
Task |
801A | Provide enterprise cybersecurity and supply chain risk management guidance. |
Task |
807 | Provide input on security requirements to be included in statements of work and other appropriate procurement documents. |
Task |
810 | Provide leadership and direction to information technology (IT) personnel by ensuring that cybersecurity awareness, basics, literacy, and training are provided to operations personnel commensurate with their responsibilities. |
Task |
848 | Recommend policy and coordinate review and approval. |
Task |
852 | Supervise or manage protective or corrective measures when an cybersecurity incident or vulnerability is discovered. |
Task |
919 | Promote awareness of security issues among management and ensure sound security principles are reflected in the organization’s vision and goals. |
Task |
947 | Oversee policy standards and implementation strategies to ensure procedures and guidelines comply with cybersecurity policies. |
Task |
952 | Knowledge of emerging security issues, risks, and vulnerabilities. |
Knowledge |
962 | Identify security requirements specific to an information technology (IT) system in all phases of the System Life Cycle. |
Task |
963 | Ensure plans of actions and milestones or remediation plans are in place for vulnerabilities identified during risk assessments, audits, inspections, etc. |
Task |
979 | Knowledge of supply chain risk management standards, processes, and practices. |
Knowledge |
1004A | Knowledge of information technology (IT) acquisition/procurement requirements. |
Knowledge |
1018 | Ensure all acquisitions, procurements, and outsourcing efforts address information security requirements consistent with organization goals. |
Task |
1041 | Define and/or implement policies and procedures to ensure protection of critical infrastructure as appropriate. |
Task |
1061A | Knowledge of the acquisition/procurement life cycle process. |
Knowledge |
1125 | Knowledge of Cloud-based knowledge management technologies and concepts related to security, governance, procurement, and administration. |
Knowledge |
1148B | Ensure supply chain, system, network, performance, and cyber security requirements are included in contract language and delivered. |
Task |
1148 | Develop contract language to ensure supply chain, system, network, and operational security are met. |
Task |
1157 | * Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity. |
Knowledge |
1158 | * Knowledge of cybersecurity principles. |
Knowledge |
1159 | * Knowledge of cyber threats and vulnerabilities. |
Knowledge |
2090 | Collaborate with other internal and external partner organizations on target access and operational issues. |
Task |
2091 | Collaborate with other team members or partner organizations to develop a diverse program of information materials (e.g., web pages, briefings, print materials). |
Task |
2416 | Facilitate interactions between internal and external partner decision makers to synchronize and integrate courses of action in support of objectives. |
Task |
2558 | Maintain relationships with internal and external partners involved in cyber planning or related areas. |
Task |
2624 | Conduct long-range, strategic planning efforts with internal and external partners in cyber activities. |
Task |
2823 | Serve as a liaison with external partners. |
Task |
2839 | Supervise and assign work to programmers, designers, technologists and technicians and other engineering and scientific personnel. |
Task |
2894 | Collaborate across internal and/or external organizational lines to enhance collection, analysis and dissemination. |
Task |
3011 | Ability to apply critical reading/thinking skills. |
Ability |
3044 | Ability to exercise judgment when policies are not well-defined. |
Ability |
3057 | Ability to interpret and apply laws, regulations, policies, and guidance relevant to organization cyber objectives. |
Ability |
3076 | Ability to tailor technical and planning information to a customer’s level of understanding. |
Ability |
3077 | Ability to think critically. |
Ability |
3994 | Ability to coordinate, collaborate and disseminate information to subordinate, lateral and higher-level organizations. |
Ability |
5170 | Coordinate with organizational manpower stakeholders to ensure appropriate allocation and distribution of human capital assets. |
Task |
5560 | Promote awareness of cyber policy and strategy as appropriate among management and ensure sound principles are reflected in the organization’s mission, vision, and goals. |
Task |
5767 | Collaborate on cyber privacy and security policies and procedures. |
Task |
5768 | Collaborate with cyber security personnel on the security risk assessment process to address privacy compliance and risk mitigation. |
Task |
5820 | Appoint and guide a team of IT security experts. |
Task |
5825 | Collaborate with key stakeholders to establish a cybersecurity risk management program |
Task |
6100 | Ability to develop policy, plans, and strategy in compliance with laws, regulations, policies, and standards in support of organizational cyber activities. |
Ability |
6900 | * Knowledge of specific operational impacts of cybersecurity lapses. |
Knowledge |
6915 | Skill in communicating with all levels of management including Board members (e.g., interpersonal skills, approachability, effective listening skills, appropriate use of style and language for the audience). |
Skill |
6920 | Ability to ensure information security management processes are integrated with strategic and operational planning processes. |
Ability |
6921 | Ability to ensure that senior officials within the organization provide information security for the information and systems that support the operations and assets under their control. |
Ability |
6922 | Ability to prioritize and allocate cybersecurity resources correctly and efficiently. |
Ability |
6923 | Ability to relate strategy, business, and technology in the context of organizational dynamics. |
Ability |
6925 | Ability to understand the basic concepts and issues related to cyber and its organizational impact. |
Ability |
6926 | Knowledge of Application Security Risks (e.g. Open Web Application Security Project Top 10 list). |
Knowledge |
6935 | * Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS). |
Knowledge |
6938 | * Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments. |
Knowledge |
6947 | Skill to anticipate new security threats. |
Skill |
6948 | Skill to remain aware of evolving technical infrastructures. |
Skill |
6949 | Skill to use critical thinking to analyze organizational patterns and relationships. |
Skill |
7110 | Ability to understand technology, management, and leadership issues related to organization processes and problem solving. |
Ability |
Additional KSATs
KSAT ID | Description | KSAT |
---|---|---|
325 | Knowledge of secure acquisitions (e.g., relevant Contracting Officer’s Technical Representative [COTR] duties, secure procurement, supply chain risk management). |
Knowledge |
398 | Advocate organization’s official position in legal and legislative proceedings. |
Task |
706 | Manage the publishing of Computer Network Defense guidance (e.g., TCNOs, Concept of Operations, Net Analyst Reports, NTSM, MTOs) for the enterprise constituency. |
Task |
949 | Evaluate the effectiveness of procurement function in addressing information security requirements and supply chain risks through procurement activities and recommend improvements. |
Task |
954 | Knowledge of import/export control regulations and responsible agencies for the purposes of reducing supply chain risk. |
Knowledge |
955B | Review and approve a supply chain security/risk management policy. |
Task |
965 | Knowledge of organization’s risk tolerance and/or risk management approach. |
Knowledge |
1004 | Knowledge of critical information technology (IT) procurement requirements. |
Knowledge |
2058 | Assist and advise inter-agency partners in identifying and developing best practices for facilitating operational support to achievement of organization objectives. |
Task |
2328 | Develop, maintain, and assess cyber cooperation security agreements with external partners. |
Task |
2443 | Identify and manage security cooperation priorities with external partners. |
Task |
5763 | Act as, or work with, counsel relating to business partner contracts. |
Task |
6160 | Ability to oversee the development and update of the lifecycle cost estimate. |
Ability |
6930 | Knowledge of cyber competitions as a way of developing skills by providing hands-on experience in simulated, real-world situations. |
Knowledge |
Develops and oversees privacy compliance program and privacy program staff, supporting privacy compliance needs of privacy and security executives and their teams.
Core KSATs
KSAT ID | Description | KSAT |
---|---|---|
22 | * Knowledge of computer networking concepts and protocols, and network security methodologies. |
Knowledge |
100 | Knowledge of Privacy Impact Assessments. |
Knowledge |
108 | * Knowledge of risk management processes (e.g., methods for assessing and mitigating risk). |
Knowledge |
395 | Advise senior management (e.g., CIO) on risk levels and security posture. |
Task |
396 | Advise senior management (e.g., CIO) on cost/benefit analysis of information security programs, policies, processes, and systems, and elements. |
Task |
457 | Conduct Privacy Impact Assessments (PIA) of the application’s security design for the appropriate security controls, which protect the confidentiality and integrity of Personally Identifiable Information (PII). |
Task |
677 | Interpret patterns of non compliance to determine their impact on levels of risk and/or overall effectiveness of the enterprise’s cybersecurity program. |
Task |
784 | Prepare audit reports that identify technical and procedural findings, and provide recommended remediation strategies/solutions. |
Task |
1036 | Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed. |
Knowledge |
1157 | * Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity. |
Knowledge |
1158 | * Knowledge of cybersecurity principles. |
Knowledge |
1159 | * Knowledge of cyber threats and vulnerabilities. |
Knowledge |
3076 | Ability to tailor technical and planning information to a customer’s level of understanding. |
Ability |
3651 | Knowledge of what constitutes a “threat” to a network. |
Knowledge |
5430 | Present technical information to technical and non-technical audiences. |
Task |
5560 | Promote awareness of cyber policy and strategy as appropriate among management and ensure sound principles are reflected in the organization’s mission, vision, and goals. |
Task |
5761 | Account for and administer individual requests for release or disclosure of personal and/or protected information. |
Task |
5762 | Act as a liaison to the information systems department. |
Task |
5763 | Act as, or work with, counsel relating to business partner contracts. |
Task |
5764 | Administer action on all complaints concerning the organization’s privacy policies and procedures in coordination and collaboration with other similar functions and, when necessary, legal counsel. |
Task |
5765 | Assist the Security Officer with the development and implementation of an information infrastructure. |
Task |
5766 | Assure that the use of technologies maintain, and do not erode, privacy protections on use, collection and disclosure of personal information. |
Task |
5767 | Collaborate on cyber privacy and security policies and procedures. |
Task |
5768 | Collaborate with cyber security personnel on the security risk assessment process to address privacy compliance and risk mitigation. |
Task |
5769 | Conduct on-going privacy training and awareness activities. |
Task |
5770 | Conduct periodic information privacy impact assessments and ongoing compliance monitoring activities in coordination with the organization’s other compliance and operational assessment functions. |
Task |
5771 | Conduct privacy impact assessments of proposed rules on the privacy of personal information, including the type of personal information collected and the number of people affected. |
Task |
5772 | Coordinate with the appropriate regulating bodies to ensure that programs, policies and procedures involving civil rights, civil liberties and privacy considerations are addressed in an integrated and comprehensive manner. |
Task |
5773 | Coordinate with the Chief Information Security Officer to ensure alignment between security and privacy practices. |
Task |
5774 | Coordinate with the Corporate Compliance Officer re: procedures for documenting and reporting self-disclosures of any evidence of privacy violations. |
Task |
5776 | Develop and coordinate a risk management and compliance framework for privacy. |
Task |
5777 | Develop and manage enterprise-wide procedures to ensure the development of new products and services is consistent with company privacy policies and legal obligations. |
Task |
5778 | Develop and manage procedures for vetting and auditing vendors for compliance with the privacy and data security policies and legal requirements. |
Task |
5779 | Develop privacy training materials and other communications to increase employee understanding of company privacy policies, data handling practices and procedures and legal obligations. |
Task |
5780 | Direct and oversee privacy specialists and coordinate privacy and data security programs with senior executives globally to ensure consistency across the organization. |
Task |
5781 | Ensure all processing and/or databases are registered with the local privacy/data protection authorities where required. |
Task |
5782 | Ensure compliance with privacy practices and consistent application of sanctions for failure to comply with privacy policies for all individuals in the organization’s workforce, extended workforce and for all business associates in cooperation with Human Resources, the information security officer, administration and legal counsel as applicable. |
Task |
5783 | Ensure that the company maintains appropriate privacy and confidentiality notices, consent and authorization forms, and materials. |
Task |
5784 | Establish a process for receiving, documenting, tracking, investigating and taking action on all complaints concerning the organization’s privacy policies and procedures. |
Task |
5785 | Establish an internal privacy audit program. |
Task |
5786 | Establish with management and operations a mechanism to track access to protected health information, within the purview of the organization and as required by law and to allow qualified individuals to review or receive a report on such activity. |
Task |
5787 | Establish, implement and maintains organization-wide policies and procedures to comply with privacy regulations. |
Task |
5788 | Identify and correct potential company compliance gaps and/or areas of risk to ensure full compliance with privacy regulations. |
Task |
5789 | Interface with Senior Management to develop strategic plans for the collection, use and sharing of information in a manner that maximizes its value while complying with applicable privacy regulations. |
Task |
5791 | Maintain current knowledge of applicable federal and state privacy laws and accreditation standards, and monitor advancements in information privacy technologies to ensure organizational adaptation and compliance. |
Task |
5792 | Manage privacy incidents and breaches in conjunction with the Privacy Officer, Chief Information Security Officer, legal counsel, and the business units. |
Task |
5793 | Mitigate effects of a use or disclosure of personal information by employees or business partners. |
Task |
5794 | Monitor systems development and operations for security and privacy compliance. |
Task |
5795 | Oversee, direct, deliver or ensure delivery of initial privacy training and orientation to all employees, volunteers, contractors, alliances, business associates and other appropriate third parties. |
Task |
5796 | Participate in the implementation and ongoing compliance monitoring of all trading partner and business associate agreements, to ensure all privacy concerns, requirements, and responsibilities are addressed. |
Task |
5797 | Periodically revise the privacy program in light of changes in laws, regulatory, or company policy. |
Task |
5798 | Provide development guidance and assist in the identification, implementation, and maintenance of organization information privacy policies and procedures in coordination with organization management and administration and legal counsel. |
Task |
5799 | Provide leadership for the organization’s privacy program. |
Task |
5800 | Provide leadership in the planning, design and evaluation of privacy and security related projects. |
Task |
5801 | Provide strategic guidance to corporate officers regarding information resources and technology. |
Task |
5802 | Report on a periodic basis regarding the status of the privacy program to the Board, CEO or other responsible individual or committee. |
Task |
5803 | Resolve allegations of non-compliance with the corporate privacy policies or notice of information practices. |
Task |
5804 | Review all system-related information security plans to ensure alignment between security and privacy practices. |
Task |
5805 | Serve as the information privacy liaison for users of technology systems. |
Task |
5806 | Serve in a leadership role for Privacy Oversight Committee activities. |
Task |
5807 | Support the organization’s privacy compliance program, working closely with the Privacy Officer, Chief Information Security Officer, and other business leaders to ensure compliance with federal and state privacy laws and regulations. |
Task |
5808 | Develop appropriate sanctions for failure to comply with the corporate privacy policies and procedures. |
Task |
5809 | Undertake a comprehensive review of the company’s data and privacy projects and ensure that they are consistent with corporate privacy and data security goals and policies. |
Task |
5810 | Work cooperatively with applicable organization units in overseeing consumer information access rights. |
Task |
5811 | Work with all organization personnel involved with any aspect of release of protected information to ensure coordination with the organization’s policies, procedures and legal requirements. |
Task |
5812 | Work with business teams and senior management to ensure awareness of “best practices” on privacy and data security issues. |
Task |
5813 | Work with external affairs to develop relationships with consumer organizations and other NGOs with an interest in privacy and data security issues—and to manage company participation in public events related to privacy and data security. |
Task |
5815 | Work with External Affairs to respond to press and other inquiries with regard to concern over consumer and employee data. |
Task |
5816 | Work with legal counsel and management, key departments and committees to ensure the organization has and maintains appropriate privacy and confidentiality consent, authorization forms and information notices and materials reflecting current organization and legal practices and requirements. |
Task |
5817 | Work with organization administration, legal counsel and other related parties to represent the organization’s information privacy interests with external parties, including government bodies, which undertake to adopt or amend privacy legislation, regulation or standard. |
Task |
5818 | Work with organization senior management to establish an organization-wide Privacy Oversight Committee. |
Task |
5819 | Work with the general counsel, external affairs and businesses to ensure both existing and new services comply with privacy and data security obligations. |
Task |
6100 | Ability to develop policy, plans, and strategy in compliance with laws, regulations, policies, and standards in support of organizational cyber activities. |
Ability |
6900 | * Knowledge of specific operational impacts of cybersecurity lapses. |
Knowledge |
6910 | Ability to determine whether a security incident violates a privacy principle or legal standard requiring specific legal action. |
Ability |
6912 | Ability to monitor advancements in information privacy laws to ensure organizational adaptation and compliance. |
Ability |
6913 | Ability to monitor advancements in information privacy technologies to ensure organizational adaptation and compliance. |
Ability |
6914 | Ability to work across departments and business units to implement organization’s privacy principles and programs, and align privacy objectives with security objectives. |
Ability |
6916 | Skill in creating policies that reflect the business’s core privacy objectives. |
Skill |
6935 | * Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS). |
Knowledge |
6938 | * Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments. |
Knowledge |
Additional KSATs
KSAT ID | Description | KSAT |
---|---|---|
9 | Knowledge of applicable business processes and operations of customer organizations. |
Knowledge |
345 | Knowledge of web mail collection, searching/analyzing techniques, tools, and cookies. |
Knowledge |
524 | Develop and maintain strategic plans. |
Task |
599 | Evaluate contracts to ensure compliance with funding, legal, and program requirements. |
Task |
600 | Evaluate cost benefit, economic, and risk analysis in decision making process. |
Task |
618A | Provide guidance on laws, regulations, policies, standards, or procedures to management, personnel, or clients. |
Task |
675 | Interpret and apply laws, regulations, policies, standards, or procedures to specific issues. |
Task |
1125 | Knowledge of Cloud-based knowledge management technologies and concepts related to security, governance, procurement, and administration. |
Knowledge |
1136A | Knowledge of use cases related to collaboration and content synchronization across platforms (e.g., Mobile, PC, Cloud). |
Knowledge |
3055A | Ability to select the appropriate implant to achieve operational goals. |
Ability |
3098 | Knowledge of virtualization products (Vmware, Virtual PC). |
Knowledge |
3637 | Knowledge of Unix/Linux and Windows operating systems structures and internals (e.g., process management, directory structure, installed applications). |
Knowledge |
3644 | Knowledge of virtual machine technologies. |
Knowledge |
3654 | Knowledge of who the organization’s operational planners are, how and where they can be contacted, and what are their expectations. |
Knowledge |
3659 | Knowledge of wireless technologies (e.g., cellular, satellite, GSM) to include the basic structure, architecture, and design of modern wireless communications systems. |
Knowledge |
3749 | Ability to develop clear directions and instructional materials. |
Ability |
4116 | Knowledge of transcript development processes and techniques (e.g., verbatim, gists, summaries). |
Knowledge |
4117 | Knowledge of translation processes and techniques. |
Knowledge |
5775 | Develop and apply corrective action procedures. |
Task |
5790 | Liaise with regulatory and accrediting bodies. |
Task |
5814 | Work with external affairs to develop relationships with regulators and other government officials responsible for privacy and data security issues. |
Task |
6110 | Ability to develop, update, and/or maintain standard operating procedures (SOPs). |
Ability |
6911 | Ability to develop or procure curriculum that speaks to the topic at the appropriate level for the target. |
Ability |
6915 | Skill in communicating with all levels of management including Board members (e.g., interpersonal skills, approachability, effective listening skills, appropriate use of style and language for the audience). |
Skill |
6917 | Skill in negotiating vendor agreements and evaluating vendor privacy practices. |
Skill |
6918 | Ability to apply cybersecurity strategy to cloud computing service and deployment models, identifying proper architecture for different operating environments. |
Ability |