Control Systems Security Specialist

• 420Apply security policies to meet security objectives of the system.Core
• 708AMitigate/correct security deficiencies identified during security/certification testing and/or recommend risk acceptance for the appropriate senior leader or authorized representative.Core
• 809Provide input to the Risk Management Framework process activities and related documentation (e.g., system life-cycle support plans, concept of operations, operational procedures, and maintenance training materials).Additional
• 5821Act as a liaison between facility operations/engineer teams and IT or network security teams to coordinate security activities.Additional
• 5822Apply tailored organizational security policies and procedures for control system environments to maintain security, but also to ensure system availability.Additional
• 5823Apply updates, patches, and security technical implementation while maintaining control system performance and availability requirements.Core
• 5826Consult on control system security matters (e.g., risk assessment, configuration management) as needed.Additional
• 5828Ensure configuration and collection of control system audit logs for monitoring and forensic analysis as appropriate.Additional
• 5829Establish and maintain security configuration baseline for the control system(s), including field devices, IT components, interconnections, and interfaces.Core
• 5830Implement Risk Management Framework (RMF) Assessment requirements for control systems, and document/maintain records for them.Core
• 5831Maintain knowledge of the function and security of control system and IT technologies with which the control systems interface.Core
• 5832Maintain network segmentation to isolate control systems from business networks and other external connections as directed.Core
• 5833Offload and review control system audit logs and review for anomalies.Additional
• 5834Participate in control system change management in conjunction with IT personnel and control system experts (e.g., system supplier).Additional
• 5835Participate in control system incident and disaster response, including secure system recovery.Additional
• 5836Perform asset management and maintain inventory of control system devices and components through physical inspection or logical scans.Core
• 5840Support risk assessments by reviewing and documenting the implementation status of security requirements of control systems.Core

• 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
• 43AKnowledge of embedded systems.Additional
• 69AKnowledge of risk management processes and requirements per the Risk Management Framework (RMF).Additional
• 79Knowledge of network access, identity, and access management (e.g., public key infrastructure [PKI]).Core
• 88AKnowledge of current and emerging cyber technologies.Additional
• 106Knowledge of remote access technology concepts.Core
• 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
• 342AKnowledge of operating system command line/prompt.Additional
• 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
• 1158* Knowledge of cybersecurity principles.Core
• 1159* Knowledge of cyber threats and vulnerabilities.Core
• 3277Knowledge of general SCADA system components.Core
• 3353Knowledge of the Risk Management Framework Assessment Methodology.Additional
• 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
• 6927Knowledge of control system environment risks, threats and vulnerabilities.Core
• 6928Knowledge of control system performance and availability requirements.Additional
• 6929Knowledge of control system technologies, such as Programmable Logic Controllers (PLCs), Supervisory Control and Data Acquisition (SCADA) software, Distributed Control Systems (DCS) and Operational Technology (OT).Core
• 6933Knowledge of risk management processes specific to control systems.Core
• 6934Knowledge of RMF assessment types (e.g., Assess & Authorize (A&A), Assess Only) and authorization boundaries (e.g., Closed Restricted Network (CRN), Stand-alone Information System (SIS)).Additional
• 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
• 6937Knowledge of what "normal" control system operations for specific mission/business functions look like.Additional
• 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
• 7111* Knowledge of Zero Trust Security Model Principles.Core

• 3ASkill in recognizing vulnerabilities in security systems.Additional
• 3740Skill in determining installed patches on various operating systems and identifying patch signatures.Core
• 6939Skill in active and passive methods to safely gather information and conduct vulnerability and network analysis scans in control system environments.Additional
• 6940Skill in applying security and managing risk in resource-constrained systems and networks.Core
• 6941Skill in architecting compensating security controls to reduce risk for control systems and control system components that do not have adequate or compliant security capabilities.Core
• 6943Skill in identifying and investigating "abnormal" control system operations based on what specific mission/business functions look like.Additional
• 6946Skill in securing control system communication protocols (e.g., IP/TCP, SSL/TLS, MODBUS/DNP3/PROFINET SCADA, GOOSE) and media used for field device control.Core

The DCWF Tool lists no abilities for this work role.