A Role-Based Model for Federal Information Technology/Cybersecurity Training

Meeting security responsibilities and providing for the confidentiality, integrity, and availability of information in today's highly networked environment can be a difficult task. Each individual that owns, uses, relies on, or manages information and information technology (IT) systems must fully understand their specific security responsibilities. This includes ownership of the information and the role individuals have in protecting information. Information that requires protection includes information they own, information provided to them as part of their work and information they may come into contact with. This document describes information technology/cybersecurity role-based training for the Federal Departments and Agencies and Organizations (Federal Organizations) and contractor support in these roles. Its primary focus is to provide a comprehensive, yet flexible, training methodology for the development of training courses or modules for personnel who have been identified as having significant information technology/cybersecurity responsibilities. This document is intended to be used by Federal information technology/cybersecurity training personnel and their contractors to assist in designing role-based training courses or modules for Federal Organizations personnel and contractors who have been identified as having significant responsibilities for information technology/cybersecurity. This publication should also be read, reviewed, or understood at a fairly high level by several audiences including the Organizational Heads through the leadership chain to the individual. Some of the titles include, but not limited to, the IT Managers, Senior Agency Information Security Officer (SAISO), Certified Information Systems Security Officer (CISSO), Information Systems Security Officer (ISSO), Information Assurance Manager (IAM), and Program Manager (PM).