Skip to content

Cyber Effects · Work role code 332

Cyber Operations Planner

The Cyberspace Operations Planner applies in-depth knowledge of the JOPP to develop detailed plans and orders supporting CCMD cyberspace operation requirements. Uses Joint, Service, and interagency planning and operational experience to conduct strategic and operational level planning across the full range of military operations for integrated information and cyberspace operations. Develops and maintains deliberate and crisis action planning products. Collaborates with cyberspace operators to identify and levy requirements for intelligence collection and analysis. Participates in targeting selection, validation, synchronization, and execution of complex cyberspace operations. Has sufficient technical knowledge to understand cyberspace operations capabilities, target vulnerabilities, and effects. Collaborates with cyberspace operators, analysts, enablers and planners to gain access and technical intelligence to meet planning objectives.

From DoD DCWF Tool v5.3 (2026-09-25)

Tasks

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 2009Provide input to the analysis, design, development or acquisition of capabilities used for meeting objectives.Unassigned
  • 2052Assess target vulnerabilities and/or operational capabilities to determine course of action.Unassigned
  • 2073Provide input to the identification of cyber-related success criteria.Unassigned
  • 2130Develop, review and implement all levels of planning guidance in support of cyber operations.Unassigned
  • 2159Contribute to crisis action planning for cyber operations.Unassigned
  • 2186Coordinate, produce and track intelligence requirements.Unassigned
  • 2237Determine indicators (e.g., measures of effectiveness) that are best suited to specific cyber operation objectives.Unassigned
  • 2265Develop and maintain deliberate and/or crisis plans.Unassigned
  • 2266Develop and review specific cyber operations guidance for integration into broader planning activities.Unassigned
  • 2272Develop cyber operations plans and guidance to ensure that execution and resource allocation decisions align with organization objectives.Unassigned
  • 2327Develop, implement, and recommend changes to appropriate planning procedures and policies.Unassigned
  • 2365Ensure operational planning efforts are effectively transitioned to current operations.Unassigned
  • 2368Ensure that intelligence planning activities are integrated and synchronized with operational planning timelines.Unassigned
  • 2386Evaluate intelligence estimates to support the planning cycle.Unassigned
  • 2417Facilitate the sharing of “best practices” and “lessons learned” throughout the cyber operations community.Unassigned
  • 2424Incorporate cyber operations and communications security support plans into organization objectives.Unassigned
  • 2425Incorporate intelligence and counterintelligence to support plan development.Unassigned
  • 2446Identify and submit intelligence requirements for the purposes of designating priority information requirements.Unassigned
  • 2459Identify intelligence gaps and shortfalls.Unassigned
  • 2509Provide input to or develop courses of action based on threat factors.Unassigned
  • 2524Integrate cyber planning/targeting efforts with other organizations.Unassigned
  • 2528Interpret environment preparation assessments to determine a course of action.Unassigned
  • 2529Issue requests for information.Unassigned
  • 2561Maintain situational awareness of cyber-related intelligence requirements and associated tasking.Unassigned
  • 2562Maintain situational awareness of partner capabilities and activities.Unassigned
  • 2590Monitor and evaluate integrated cyber operations to identify opportunities to meet organization objectives.Unassigned
  • 2621Provide SME and support to planning/developmental forums and working groups as appropriate.Unassigned
  • 2626Provide subject matter expertise to planning efforts with internal and external cyber operations partners.Unassigned
  • 2628Participate in exercises.Unassigned
  • 2752Provide input to the administrative and logistical elements of an operational support plan.Unassigned
  • 2770Provide time sensitive targeting support.Unassigned
  • 2806Review and comprehend organizational leadership objectives and guidance for planning.Unassigned
  • 2837Submit or respond to requests for deconfliction of cyber operations.Unassigned
  • 2888Document lessons learned that convey the results of events and/or exercises.Unassigned
  • 8004Analyze data (e.g., MOEs, MOPs) to determine mission effectiveness.Unassigned
  • 8018Assess data to determine whether an event meets CCIR criteria.Unassigned
  • 8043Contribute to and oversee cyberspace operational plans (OPLANs) to include annexes.Unassigned
  • 8044Contribute to cyberspace base plans (BPLANs), concept plans (CONPLANs).Unassigned
  • 8045Contribute to cyberspace Execution Orders (EXORDs).Unassigned
  • 8046Contribute to cyberspace Operational Orders (OPORDs).Unassigned
  • 8048Coordinate operational planning teams (OPTs), coordination groups, and task forces as necessary.Unassigned
  • 8069Develop cyberspace operations TTPs for integration into operational and tactical levels of planning.Unassigned
  • 8070Develop detailed operational and tactical plans and orders supporting cyberspace operations requirements at the tactical levels of warfare.Unassigned
  • 8098Evaluate reporting (e.g., BDA, MOEs, MISREP) in order to support commanders decisions.Unassigned
  • 8104Facilitate the development of partnership agreements.Unassigned
  • 8105Gather data to support the synchronization of effects into the joint targeting cycle.Unassigned
  • 8119Integrate cyberspace operations planning efforts with domestic and foreign partners.Unassigned
  • 8122Interpret complex and rapidly evolving concepts.Unassigned
  • 8123Interpret cyberspace base plans (BPLANs), concept plans (CONPLANs).Unassigned
  • 8124Interpret cyberspace Operational Orders (OPORDs).Unassigned
  • 8125Interpret cyberspace Warning Orders (WARNORDs), Alert Orders (ALERTORD), and Fragmentary Orders (FRAGORDs).Unassigned
  • 8126Lead planning efforts with other DOD and non-DOD cyberspace operations partners.Unassigned
  • 8127Lead the planning effort within cyberspace exercises and wargames.Unassigned
  • 8132Maintain situational awareness of the adversary.Unassigned
  • 8142Participate in planning efforts with other DOD and non-DOD cyberspace operations partners.Unassigned
  • 8146Perform operational design.Unassigned
  • 8154Prepare COAs to address CCIR events.Unassigned
  • 8163Provide briefings regarding mission activities to stakeholders.Unassigned
  • 8188Review cyberspace operations TTPs for integration into operational and tactical levels of planning.Unassigned

Knowledge

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
  • 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
  • 264Knowledge of basic physical computer components and architectures, including the functions of various components and peripherals (e.g., CPUs, Network Interface Cards, data storage).Unassigned
  • 270Knowledge of common adversary tactics, techniques, and procedures in assigned area of responsibility (i.e., historical country-specific tactics, techniques, and procedures; emerging capabilities).Unassigned
  • 1056Knowledge of operations security.Unassigned
  • 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
  • 1158* Knowledge of cybersecurity principles.Core
  • 1159* Knowledge of cyber threats and vulnerabilities.Core
  • 2531Knowledge of organizational planning concepts.Unassigned
  • 3098Knowledge of virtualization products (VMware, Virtual PC).Unassigned
  • 3106Knowledge of a wide range of basic communications media concepts and terminology (e.g., computer and telephone networks, satellite, cable, wireless).Unassigned
  • 3114Knowledge of all forms of intelligence support needs, topics, and focus areas.Unassigned
  • 3146Knowledge of both internal and external customers and partner organizations, including information needs, objectives, structure, capabilities, etc.Unassigned
  • 3154Knowledge of classification and control markings standards, policies and procedures.Unassigned
  • 3159Knowledge of cyber operations support or enabling processes.Unassigned
  • 3194Knowledge of crisis action planning and time sensitive planning procedures.Unassigned
  • 3211Knowledge of cyber laws and legal considerations and their effect on cyber planning.Unassigned
  • 3218Knowledge of cyber operations terminology/lexicon.Unassigned
  • 3219Knowledge of cyber operations.Unassigned
  • 3225Knowledge of data communications terminology (e.g., networking protocols, Ethernet, IP, encryption, optical devices, removable media).Unassigned
  • 3235Knowledge of deconfliction processes and procedures.Unassigned
  • 3257Knowledge of target and threat organization structures, critical capabilities, and critical vulnerabilities.Unassigned
  • 3262Knowledge of evolving/emerging communications technologies.Unassigned
  • 3264Knowledge of existing, emerging, and long-range issues related to cyber operations strategy, policy, and organization.Unassigned
  • 3268Knowledge of staff management, assignment, and allocation processes.Unassigned
  • 3271Knowledge of internal and external partner cyber operations capabilities and tools.Unassigned
  • 3287Knowledge of how collection requirements and information needs are translated, tracked, and prioritized across the extended enterprise.Unassigned
  • 3338Knowledge of intelligence reporting principles, policies, procedures, and vehicles, including report formats, reportability criteria (requirements and priorities), dissemination practices, and legal authorities and restrictions.Unassigned
  • 3358Knowledge of organizational hierarchy and cyber decision making processes.Unassigned
  • 3374Knowledge of malware.Unassigned
  • 3391Knowledge of objectives, situation, operational environment, and the status and disposition of internal and external partner collection capabilities available to support planning.Unassigned
  • 3441Knowledge of physical and logical network devices and infrastructure to include hubs, switches, routers, firewalls, etc.Unassigned
  • 3572Knowledge of organization decision support tools and/or methods.Unassigned
  • 3582Knowledge of the intelligence frameworks, processes, and related systems.Unassigned
  • 3585Knowledge of accepted organization planning systems.Unassigned
  • 3605Knowledge of the information environment.Unassigned
  • 3610Knowledge of the relationships between end states, objectives, effects, lines of operation, etc.Unassigned
  • 3615Knowledge of the structure and intent of organization specific plans, guidance and authorizations.Unassigned
  • 3616Knowledge of the structure, architecture, and design of modern digital and telephony networks.Unassigned
  • 4106Knowledge of analytic tools and techniques.Unassigned
  • 4389Knowledge of accessing a network remotely (e.g., bypassing IDS/IPS, credential harvesting, vulnerability analysis, COTS toolkit employment).Unassigned
  • 4425Knowledge of cyber laws, legal considerations—to include the law of armed conflict (LOAC) and designated rules of engagement (ROE)—and their effect on cyberspace operations.Unassigned
  • 4446Knowledge of exploitation methods.Unassigned
  • 4449Knowledge of formal coordination procedures.Unassigned
  • 4451Knowledge of the full spectrum of cyberspace operational missions (e.g., DODIN Operations, DCO, OCO), principles, capabilities, limitations, and effects.Unassigned
  • 4454Knowledge of hacker methodology.Unassigned
  • 4459Knowledge of host and network security.Unassigned
  • 4471Knowledge of intelligence/SIGINT reporting and dissemination procedures.Unassigned
  • 4474Knowledge of joint doctrine and joint planning concepts, to include knowledge of the JPP (JP 5-0).Unassigned
  • 4475Knowledge of joint doctrine for information activities (JP 3-04).Unassigned
  • 4476Knowledge of joint doctrine intelligence concepts (JP 2-0).Unassigned
  • 4477Knowledge of joint doctrine operations concepts (JP 3-0).Unassigned
  • 4478Knowledge of joint doctrine targeting concepts (JP 3-60).Unassigned
  • 4504Knowledge of operational assessment (i.e., BDA and Restrike Recommendation (RR)).Unassigned
  • 4507Knowledge of operational platforms.Unassigned
  • 4512Knowledge of persistence tools and methods (e.g., Implants/Rootkits, Tunneling, Native Actions).Unassigned
  • 4515Knowledge of Post-Exploitation TTPs (e.g., data exfiltration, privilege escalation, operational prep of the environment).Unassigned
  • 4579Knowledge of the structure and intent of USCYBERCOM and its subordinate organizations specific plans, orders, and standing rules of engagement.Unassigned
  • 4582Knowledge of the U.S. SIGINT System (USSS) authorities, responsibilities, and contributions to the cyberspace operations mission.Unassigned
  • 4590Knowledge of USCYBERCOM cyberspace operations terminology.Unassigned
  • 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
  • 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
  • 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
  • 7111* Knowledge of Zero Trust Security Model Principles.Core

Skills

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 3665Skill in administrative planning activities, to include preparation of functional and specific support plans, preparing and managing correspondence, and staffing procedures.Unassigned
  • 3766Skill in documenting and communicating complex technical and programmatic information.Unassigned
  • 3772Skill in evaluating information for reliability, validity, and relevance.Unassigned
  • 3844Skill in preparing and presenting briefings.Unassigned

Abilities

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 3001Ability to accurately and completely source all data used in intelligence, assessment and/or planning products.Unassigned
  • 3011Ability to apply critical reading/thinking skills.Unassigned
  • 3021Ability to collaborate effectively with others.Unassigned
  • 3022Ability to communicate complex information, concepts, or ideas in a confident and well-organized manner through verbal, written, and/or visual means.Unassigned
  • 3033Ability to coordinate cyber operations with other organization functions or support activities.Unassigned
  • 3044Ability to exercise judgment when policies are not well-defined.Unassigned
  • 3076Ability to tailor technical and planning information to a customer’s level of understanding.Unassigned
  • 4190Ability to apply the Joint Planning Process (JPP).Unassigned
  • 4355Ability to solve complex problems.Unassigned

Workforce Automation analysis, not part of the source

O*NET jobs

WFA · Part of the paid plan when accounts open

Jobs the ETO-CSET NICE/O*NET crosswalk (2024) maps to this role’s NICE equivalents, with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill.

No O*NET jobs reach this role.

    Equivalents

    NICE work roles

    From DoD DCWF Tool v5.3 (2026-09-25), linked from published ids only, never from titles

    Free · DoD DCWF Tool v5.3 (2026-09-25)

    No published NICE equivalent.

    O*NET jobs it reaches

    Through its NICE equivalents, by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3

    Free · O*NET 30.3

    No O*NET job reaches this role.