Authorizing Official/Designated Representative

• 600Evaluate cost benefit, economic, and risk analysis in decision making process.Additional
• 696BAuthorizing Official only: Approve authorization packages.Core
• 696CManage authorization packages.Core
• 710Monitor and evaluate a system's compliance with information technology (IT) security, resilience, and dependability requirements.Additional
• 801BProvide cybersecurity and supply chain risk management guidance.Core
• 836AAuthorizing Official only: Determine if the security and privacy risk from operating a system or using a system, service, or application from an external provider is acceptable.Core
• 1146Develop and Implement cybersecurity independent audit processes for application software/networks/systems and oversee ongoing independent audits to ensure that operational and Research and Development (R&D) processes and procedures are in compliance with organizational and mandatory cybersecurity requirements and accurately followed by Systems Administrators and other cybersecurity staff when performing their day-to-day activities.Additional
• 5320Establish acceptable limits for the software application, network, or system.Core
• 5824Authorizing Official only: Approve security and privacy assessment plans for systems and environments of operation.Core
• 5827Determine the authorization boundaries of systems.Core
• 5837Respond to threats and vulnerabilities based on the results of ongoing/continuous monitoring activities and risk assessments and decide if risk remains acceptable.Additional
• 5838Review and approve security categorization results for systems.Core
• 5839Review security and privacy assessment plans for systems and environments of operation.Core

• 19Knowledge of cyber defense and vulnerability assessment tools, including open source tools, and their capabilities.Additional
• 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
• 27Knowledge of cryptography and cryptographic key management concepts.Additional
• 38Knowledge of organization's enterprise information security architecture system.Core
• 40Knowledge of organization's evaluation and validation requirements.Additional
• 43AKnowledge of embedded systems.Additional
• 53Knowledge of the Security Assessment and Authorization process.Core
• 55Knowledge of cybersecurity principles used to manage risks related to the use, processing, storage, and transmission of information or data.Core
• 58Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins.Additional
• 63Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).Core
• 69Knowledge of Risk Management Framework (RMF) requirements.Core
• 70Knowledge of information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).Additional
• 77Knowledge of current industry methods for evaluating, implementing, and disseminating information technology (IT) security assessment, monitoring, detection, and remediation tools and procedures utilizing standards-based concepts and capabilities.Core
• 88Knowledge of new and emerging information technology (IT) and cybersecurity technologies.Core
• 95AKnowledge of penetration testing principles, tools, and techniques.Additional
• 98Knowledge of policy-based and risk adaptive access controls.Additional
• 105Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).Additional
• 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
• 121Knowledge of structured analysis principles and methods.Core
• 128Knowledge of systems diagnostic tools and fault identification techniques.Additional
• 143Knowledge of the organization’s enterprise information technology (IT) goals and objectives.Additional
• 156AKnowledge of confidentiality, integrity, and availability principles.Core
• 177BKnowledge of countermeasures for identified security risks.Additional
• 325Knowledge of secure acquisitions (e.g., relevant Contracting Officer's Technical Representative [COTR] duties, secure procurement, supply chain risk management).Additional
• 942Knowledge of the organization's core business/mission processes.Additional
• 952Knowledge of emerging security issues, risks, and vulnerabilities.Additional
• 965Knowledge of organization's risk tolerance and/or risk management approach.Additional
• 979Knowledge of supply chain risk management standards, processes, and practices.Core
• 1034AKnowledge of Personally Identifiable Information (PII) data security standards.Core
• 1034BKnowledge of Payment Card Industry (PCI) data security standards.Additional
• 1034CKnowledge of Personal Health Information (PHI) data security standards.Additional
• 1036Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed.Core
• 1037Knowledge of information technology (IT) supply chain security and risk management policies, requirements, and procedures.Core
• 1037AKnowledge of information technology (IT) risk management policies, requirements, and procedures.Core
• 1038Knowledge of local specialized system requirements (e.g., critical infrastructure systems that may not use standard information technology [IT]) for safety, performance, and reliability.Additional
• 1040AKnowledge of relevant laws, policies, procedures, or governance related to critical infrastructure.Core
• 1072Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth, Zero Trust).Core
• 1131Knowledge of security architecture concepts and enterprise architecture reference models (e.g., Zachman, Federal Enterprise Architecture [FEA]).Additional
• 1142Knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).Additional
• 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
• 1157AKnowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity and AI.Additional
• 1158* Knowledge of cybersecurity principles.Core
• 1159* Knowledge of cyber threats and vulnerabilities.Core
• 3591Knowledge of organization objectives, leadership priorities, and decision-making risks.Additional
• 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
• 6931Knowledge of methods and techniques for analyzing risk.Additional
• 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
• 6936Knowledge of types of authorizations.Core
• 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
• 7111* Knowledge of Zero Trust Security Model Principles.Core

• 179Skill in designing security controls based on cybersecurity principles and tenets.Additional
• 197Skill in discerning the protection needs (i.e., security controls) of information systems and networks.Core

The DCWF Tool lists no abilities for this work role.