Skip to content

Intel (Cyber) · Work role code 331

Cyber Intelligence Planner

Develops detailed intelligence plans to satisfy cyber operations requirements. Collaborates with cyber operations planners to identify, validate, and levy requirements for collection and analysis. Participates in targeting selection, validation, synchronization, and execution of cyber actions. Synchronizes intelligence activities to support organization objectives in cyberspace.

From DoD DCWF Tool v5.3 (2026-09-25)

Tasks

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 2009Provide input to the analysis, design, development or acquisition of capabilities used for meeting objectives.Core
  • 2043Coordinate for intelligence support to operational planning activities.Core
  • 2045Assess all-source intelligence and recommend targets to support cyber operation objectives.Core
  • 2052Assess target vulnerabilities and/or operational capabilities to determine course of action.Core
  • 2058Assist and advise interagency partners in identifying and developing best practices for facilitating operational support to achievement of organization objectives.Additional
  • 2064Assist in the development and refinement of priority information requirements.Core
  • 2070Enable synchronization of intelligence support plans across partner organizations as required.Core
  • 2073Provide input to the identification of cyber-related success criteria.Additional
  • 2091Collaborate with other team members or partner organizations to develop a diverse program of information materials (e.g., web pages, briefings, print materials).Additional
  • 2159Contribute to crisis action planning for cyber operations.Core
  • 2160Contribute to the development of the organization's decision support tools if necessary.Additional
  • 2163Incorporate intelligence equities into the overall design of cyber operations plans.Core
  • 2181Coordinate with intelligence planners to ensure collection managers receive information requirements.Core
  • 2185Coordinate with the intelligence planning team to assess capability to satisfy assigned intelligence tasks.Core
  • 2186Coordinate, produce and track intelligence requirements.Core
  • 2187Coordinate, synchronize and draft applicable intelligence sections of cyber operations plans.Core
  • 2192Use intelligence estimates to counter potential target actions.Additional
  • 2237Determine indicators (e.g., measures of effectiveness) that are best suited to specific cyber operation objectives.Core
  • 2267Develop and review intelligence guidance for integration into supporting cyber operations planning and execution.Core
  • 2276Develop detailed intelligence support to cyber operations requirements.Core
  • 2310Develop potential courses of action.Additional
  • 2327Develop, implement, and recommend changes to appropriate planning procedures and policies.Additional
  • 2352Draft cyber intelligence collection and production requirements.Core
  • 2368Ensure that intelligence planning activities are integrated and synchronized with operational planning timelines.Core
  • 2386Evaluate intelligence estimates to support the planning cycle.Core
  • 2392Evaluate the conditions that affect employment of available cyber intelligence capabilities.Additional
  • 2425Incorporate intelligence and counterintelligence to support plan development.Core
  • 2435Identify all available partner intelligence capabilities and limitations supporting cyber operations.Additional
  • 2442Identify, draft, evaluate, and prioritize relevant intelligence or information requirements.Core
  • 2459AIdentify cyber intelligence gaps and shortfalls.Core
  • 2484Identify the need, scope, and timeframe for applicable intelligence environment preparation derived production.Core
  • 2509Provide input to or develop courses of action based on threat factors.Core
  • 2528Interpret environment preparation assessments to determine a course of action.Additional
  • 2529Issue requests for information.Core
  • 2532Lead and coordinate intelligence support to operational planning.Core
  • 2558Maintain relationships with internal and external partners involved in cyber planning or related areas.Core
  • 2564Maintain situational awareness to determine if changes to the operating environment require review of the plan.Additional
  • 2619Provide subject matter expertise to planning teams, coordination groups, and task forces as necessary.Core
  • 2624Conduct long-range, strategic planning efforts with internal and external partners in cyber activities.Core
  • 2702Prepare for and provide subject matter expertise to exercises.Additional
  • 2736Provide cyber focused guidance and advice on intelligence support plan inputs.Core
  • 2778Recommend refinement, adaptation, termination, and execution of operational plans as appropriate.Core
  • 2806Review and comprehend organizational leadership objectives and guidance for planning.Core
  • 2819Scope the cyber intelligence planning effort.Core
  • 2888Document lessons learned that convey the results of events and/or exercises.Core

Knowledge

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
  • 52Knowledge of human-computer interaction principles.Additional
  • 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
  • 264Knowledge of basic physical computer components and architectures, including the functions of various components and peripherals (e.g., CPUs, Network Interface Cards, data storage).Core
  • 1056Knowledge of operations security.Core
  • 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
  • 1158* Knowledge of cybersecurity principles.Core
  • 1159* Knowledge of cyber threats and vulnerabilities.Core
  • 2530Knowledge and understanding of operational design.Core
  • 2531Knowledge of organizational planning concepts.Core
  • 3095Knowledge of internet network addressing (IP addresses, classless inter-domain routing, TCP/UDP port numbering).Additional
  • 3098Knowledge of virtualization products (VMware, Virtual PC).Additional
  • 3106Knowledge of a wide range of basic communications media concepts and terminology (e.g., computer and telephone networks, satellite, cable, wireless).Core
  • 3107Knowledge of a wide range of concepts associated with websites (e.g., website types, administration, functions, software systems, etc.).Core
  • 3114Knowledge of all forms of intelligence support needs, topics, and focus areas.Core
  • 3117Knowledge of all-source reporting and dissemination procedures.Core
  • 3129Knowledge of attack methods and techniques (DDoS, brute force, spoofing, etc.).Core
  • 3154Knowledge of classification and control markings standards, policies and procedures.Core
  • 3155Knowledge of client organizations, including information needs, objectives, structure, capabilities, etc.Core
  • 3159Knowledge of cyber operations support or enabling processes.Core
  • 3174Knowledge of the intelligence requirements development and request for information processes.Core
  • 3177Knowledge of common computer/network infections (virus, Trojan, etc.) and methods of infection (ports, attachments, etc.).Core
  • 3188Knowledge of computer networking fundamentals (i.e., basic computer components of a network, types of networks, etc.).Core
  • 3194Knowledge of crisis action planning and time sensitive planning procedures.Core
  • 3205Knowledge of current computer-based intrusion sets.Additional
  • 3211Knowledge of cyber laws and legal considerations and their effect on cyber planning.Additional
  • 3215Knowledge of cyber actions (i.e., cyber defense, information gathering, environment preparation, cyber attack) principles, capabilities, limitations, and effects.Core
  • 3225Knowledge of data communications terminology (e.g., networking protocols, Ethernet, IP, encryption, optical devices, removable media).Core
  • 3235Knowledge of deconfliction processes and procedures.Additional
  • 3253Knowledge of encryption algorithms and cyber capabilities/tools (e.g., SSL, PGP).Additional
  • 3257Knowledge of target and threat organization structures, critical capabilities, and critical vulnerabilities.Core
  • 3262Knowledge of evolving/emerging communications technologies.Additional
  • 3264Knowledge of existing, emerging, and long-range issues related to cyber operations strategy, policy, and organization.Core
  • 3271Knowledge of internal and external partner cyber operations capabilities and tools.Additional
  • 3274Knowledge of fundamental cyber operations concepts, terminology/lexicon (i.e., environment preparation, cyber attack, cyber defense), principles, capabilities, limitations, and effects.Core
  • 3275Knowledge of fundamental cyber concepts, principles, limitations, and effects.Core
  • 3286Knowledge of host-based security products and how they affect exploitation and vulnerability.Additional
  • 3287Knowledge of how collection requirements and information needs are translated, tracked, and prioritized across the extended enterprise.Core
  • 3291Knowledge of how internet applications work (SMTP email, web-based email, chat clients, VOIP).Additional
  • 3292Knowledge of how modern digital and telephony networks impact cyber operations.Additional
  • 3293Knowledge of how modern wireless communications systems impact cyber operations.Additional
  • 3311Knowledge of analytical standards and the purpose of intelligence confidence levels.Core
  • 3326Knowledge of information security concepts, facilitating technologies and methods.Additional
  • 3336Knowledge of intelligence employment requirements (i.e., logistical, communications support, maneuverability, legal restrictions, etc.).Core
  • 3340Knowledge of intelligence requirements tasking systems.Core
  • 3342Knowledge of intelligence support to planning, execution, and assessment.Core
  • 3356Knowledge of organization policies and planning concepts for partnering with internal and/or external organizations.Additional
  • 3358Knowledge of organizational hierarchy and cyber decision making processes.Additional
  • 3374Knowledge of malware.Additional
  • 3388Knowledge of crisis action planning for cyber operations.Core
  • 3391Knowledge of objectives, situation, operational environment, and the status and disposition of internal and external partner collection capabilities available to support planning.Additional
  • 3397Knowledge of intelligence capabilities and limitations.Core
  • 3419Knowledge of organization or partner exploitation of digital networks.Additional
  • 3443Knowledge of PIR approval process.Core
  • 3444Knowledge of planning activity initiation.Core
  • 3445Knowledge of planning timelines adaptive, crisis action, and time-sensitive planning.Core
  • 3459Knowledge of the functions and capabilities of internal teams that emulate threat activities to benefit the organization.Additional
  • 3463Knowledge of required intelligence planning products associated with cyber operational planning.Core
  • 3489Knowledge of organizational structures and associated intelligence capabilities.Core
  • 3539Knowledge of telecommunications fundamentals.Additional
  • 3543Knowledge of the basic structure, architecture, and design of modern communication networks.Additional
  • 3545Knowledge of the basics of network security (e.g., encryption, firewalls, authentication, honey pots, perimeter protection).Additional
  • 3554Knowledge of the critical information requirements and how they're used in planning.Core
  • 3560Knowledge of the production responsibilities and organic analysis and production capabilities.Core
  • 3561Knowledge of the common networking and routing protocols(e.g., TCP/IP), services (e.g., web, mail, DNS), and how they interact to provide network communications.Core
  • 3570Knowledge of the organizational structure as it pertains to full spectrum cyber operations, including the functions, responsibilities, and interrelationships among distinct internal elements.Additional
  • 3571Knowledge of the organizational planning and staffing process.Additional
  • 3572Knowledge of organization decision support tools and/or methods.Additional
  • 3578Knowledge of the impacts of internal and external partner staffing estimates.Additional
  • 3582Knowledge of the intelligence frameworks, processes, and related systems.Core
  • 3584Knowledge of intelligence preparation of the environment and similar processes.Core
  • 3585Knowledge of accepted organization planning systems.Core
  • 3591Knowledge of organization objectives, leadership priorities, and decision-making risks.Additional
  • 3601Knowledge of the outputs of course of action and exercise analysis.Additional
  • 3606Knowledge of the process used to assess the performance and impact of operations.Core
  • 3607Knowledge of the processes to synchronize operational assessment procedures with the critical information requirement process.Additional
  • 3609Knowledge of the range of cyber operations and their underlying intelligence support needs, topics, and focus areas.Core
  • 3610Knowledge of the relationships between end states, objectives, effects, lines of operation, etc.Core
  • 3611Knowledge of the relationships of operational objectives, intelligence requirements, and intelligence production tasks.Core
  • 3615Knowledge of the structure and intent of organization specific plans, guidance and authorizations.Additional
  • 3616Knowledge of the structure, architecture, and design of modern digital and telephony networks.Additional
  • 3627Knowledge of cryptologic capabilities, limitations, and contributions to cyber operations.Additional
  • 3629Knowledge of the various collection disciplines and capabilities.Core
  • 3630Knowledge of the ways in which targets or threats use the Internet.Additional
  • 3638Knowledge of organization issues, objectives, and operations in cyber as well as regulations and policy directives governing cyber operations.Additional
  • 3639Knowledge of organization cyber operations programs, strategies, and resources.Additional
  • 3651Knowledge of what constitutes a “threat” to a network.Core
  • 3659Knowledge of wireless technologies (e.g., cellular, satellite, GSM) to include the basic structure, architecture, and design of modern wireless communications systems.Core
  • 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
  • 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
  • 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
  • 7111* Knowledge of Zero Trust Security Model Principles.Core

Skills

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 3665Skill in administrative planning activities, to include preparation of functional and specific support plans, preparing and managing correspondence, and staffing procedures.Core
  • 3681Skill in applying analytical methods typically employed to support planning and to justify recommended strategies and courses of action.Core
  • 3685Skill in applying crisis planning procedures.Core
  • 3724Skill in defining and characterizing all pertinent aspects of the operational environment.Core
  • 3766Skill in documenting and communicating complex technical and programmatic information.Additional
  • 3772Skill in evaluating information for reliability, validity, and relevance.Core
  • 3844Skill in preparing and presenting briefings.Core
  • 3845Skill in preparing plans and related correspondence.Core
  • 3877Skill in reviewing and editing intelligence products from various sources for cyber operations.Additional
  • 3879Skill in reviewing and editing plans.Core
  • 3893Skill in tailoring analysis to the necessary levels (e.g., classification and organizational).Additional
  • 3938Skill in utilizing feedback in order to improve processes, products, and services.Core
  • 3946Skill in utilizing virtual collaborative workspaces and/or tools (e.g., IWS, VTCs, chat rooms, SharePoint).Additional
  • 3964Skill to analyze target or threat sources of strength and morale.Additional
  • 3965Skill to analyze strategic guidance for issues requiring clarification and/or additional guidance.Core
  • 3966Skill to anticipate intelligence capability employment requirements.Core
  • 3967Skill to anticipate key target or threat activities which are likely to prompt a leadership decision.Core
  • 3971Skill to apply analytical standards to evaluate intelligence products.Core
  • 3976Skill to apply the process used to assess the performance and impact of cyber operations.Core
  • 3978Skill to articulate the needs of joint planners to all-source analysts.Core
  • 3979Skill to articulate intelligence capabilities available to support execution of the plan.Core
  • 3987Skill to conceptualize the entirety of the intelligence process in the multiple domains and dimensions.Core
  • 3990Skill to convert intelligence requirements into intelligence production tasks.Core
  • 3992Skill to coordinate the development of tailored intelligence products.Core
  • 3996Skill to correlate intelligence priorities to the allocation of intelligence resources/assets.Core
  • 3998Skill to craft indicators of operational progress/success.Core
  • 4000Skill to create and maintain up-to-date planning documents and tracking of services/production.Core
  • 4018Skill to express orally and in writing the relationship between intelligence capability limitations and decision making risk and impacts on the overall operation.Core
  • 4023Skill to graphically depict decision support materials containing intelligence and partner capability estimates.Additional
  • 4032Skill to interpret planning guidance to discern level of analytical support required.Core
  • 4041Skill to monitor threat effects to partner capabilities and maintain a running estimate.Additional
  • 4042Skill to monitor target or threat situation and environmental factors.Additional
  • 4045Skill to orchestrate intelligence planning teams, coordinate collection and production support, and monitor status.Core
  • 4053Skill to relate intelligence resources/assets to anticipated intelligence requirements.Core
  • 4059Skill to synchronize planning activities and required intelligence support.Core

Abilities

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 3001Ability to accurately and completely source all data used in intelligence, assessment and/or planning products.Additional
  • 3003Ability to adjust to and operate in a diverse, unpredictable, challenging, and fast-paced work environment.Core
  • 3011Ability to apply critical reading/thinking skills.Core
  • 3015Ability to apply approved planning development and staffing processes.Core
  • 3021Ability to collaborate effectively with others.Core
  • 3022Ability to communicate complex information, concepts, or ideas in a confident and well-organized manner through verbal, written, and/or visual means.Core
  • 3033Ability to coordinate cyber operations with other organization functions or support activities.Core
  • 3040Ability to develop or recommend planning solutions to problems and situations for which no precedent exists.Core
  • 3041Ability to effectively collaborate via virtual teams.Core
  • 3044Ability to exercise judgment when policies are not well-defined.Core
  • 3048Ability to function in a collaborative environment, seeking continuous consultation with other analysts and experts—both internal and external to the organization—in order to leverage analytical and technical expertise.Core
  • 3054Ability to identify external partners with common cyber operations interests.Additional
  • 3057Ability to interpret and apply laws, regulations, policies, and guidance relevant to organization cyber objectives.Additional
  • 3060Ability to interpret and understand complex and rapidly evolving concepts.Core
  • 3066Ability to participate as a member of planning teams, coordination groups, and task forces as necessary.Core
  • 3076Ability to tailor technical and planning information to a customer’s level of understanding.Core

Workforce Automation analysis, not part of the source

O*NET jobs

WFA · Part of the paid plan when accounts open

Jobs the ETO-CSET NICE/O*NET crosswalk (2024) maps to this role’s NICE equivalents, with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill.

No O*NET jobs reach this role.

    Equivalents

    NICE work roles

    From DoD DCWF Tool v5.3 (2026-09-25), linked from published ids only, never from titles

    Free · DoD DCWF Tool v5.3 (2026-09-25)

    No published NICE equivalent.

    O*NET jobs it reaches

    Through its NICE equivalents, by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3

    Free · O*NET 30.3

    No O*NET job reaches this role.