Role-Based Training and Cybersecurity Workforce Plan

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

Mandate. Several federal sources require this plan:

• 5 CFR 930.301 requires each executive agency to develop a plan for information systems security awareness and training. It requires role-specific training for employees with significant information security responsibilities.
• The Federal Information Security Modernization Act (FISMA) requires the CISO to train and oversee personnel with significant security responsibilities. It also requires security awareness training for all users.
• Office of Management and Budget (OMB) Circular A-130 requires role-based security and privacy training before access or duties begin, and a current workforce planning process.
• The Federal Cybersecurity Workforce Assessment Act of 2015 requires the Organization to code every position with cybersecurity functions and to identify work roles of critical need.
• National Institute of Standards and Technology (NIST) SP 800-53 controls AT-3, PM-13, and PM-14 require role-based training, a workforce development program, and a training plan.

The CISO owns this plan, and the Senior Agency Official for Privacy (SAOP) owns its privacy training content. The Awareness and Training Policy (POL-AT) sets the rules, and the Awareness and Training Procedures (PROC-AT) name this plan.

1. Purpose and Scope #

The CISO uses this plan to make sure that each person with security or privacy duties has the skills those duties need, and that the Organization knows where it lacks them. It covers:

• role-based security and privacy training for every role in the training matrix;
• how the Organization tracks training, and what happens when training is late;
• the coding of cybersecurity positions and the yearly workforce gap analysis;
• the yearly report to the Chief Information Officer (CIO).

The plan follows the learning program life cycle in NIST SP 800-50 Rev. 1 and the work roles of the National Initiative for Cybersecurity Education (NICE) Framework, NIST SP 800-181 Rev. 1. It covers employees and contractors who hold Organization accounts. Contracts for systems that contractors run for the Organization require the contractor to train its own staff to the same standard and to give the Contracting Officer’s Representative (COR) proof.

2. Security and Privacy Awareness Training #

Every user completes security and privacy literacy training before getting access, and every year after that. The Awareness and Training Policy and Procedures set the course content, the phishing exercises, the insider threat training, and the rules for new users. This plan does not repeat them. Role-based training in this plan adds to that training and does not replace it.

Evidence: the literacy training completion records in the learning management system (LMS).

3. Roles and Responsibilities #

4. Who Has Significant Security Responsibilities #

5 CFR 930.301 names five groups. The Organization places each of its roles in one of them:

• All users of federal information systems, who receive awareness training under the Awareness and Training Procedures.
• Executives, including Authorizing Officials.
• Program and functional managers, including System Owners, Contracting Officers (COs), CORs, and privacy staff.
• The CIO, IT security program managers, auditors, and other security staff, including the CISO, Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), assessors, and incident responders.
• IT function management and operations staff, including administrators and developers.

The CISO keeps this mapping in the role catalog in the document management system and updates it when roles change.

4.1 Identifying role holders #

Evidence: the appointment tickets, the LMS role groups, the access approvals, and the quarterly reconciliations.

5. Role-Based Training Matrix #

Each person in a role below completes the role’s training before taking on the duty or the access it carries. The person finishes the first course within the set number of days after appointment. After that, the person repeats role-based training every year, and again when a system change or a new position changes the duties. The NICE work roles and Office of Personnel Management (OPM) codes come from the NICE Framework Components, version 2.2.0. The Hours column gives the hours each fiscal year, and the Group column gives the paragraph of 5 CFR 930.301(a) that covers the role.

A person with more than one role completes the training for each role. Training for one role may count toward another when it covers the same content.

5.1 Delivering role-based training #

Evidence: the approved course list, the assignment and completion records, the targeted assignments, and the content change history.

6. Tracking Training in the Learning Management System #

The LMS is the system of record for every training assignment, completion, score, and outside training credit. Each record shows the person, the role, the course, the due date, and the date finished. Staff keep training records for five (5) years or 5 years after completion of a specific training program. Supervisors see their staff’s status at any time.

Evidence: the individual training records in the LMS.

7. Completion Targets and Consequences #

The Organization expects every person in a covered role to finish training on time. Late training leads to suspension of the access it covers, and finished training restores it.

Evidence: the reminder logs, the overdue tickets, the suspension and restoration records, and the extension approvals.

8. Coding Cybersecurity Positions #

The Federal Cybersecurity Workforce Assessment Act of 2015 requires the Organization to identify every position that performs IT, cybersecurity, or cyber-related functions and to assign its employment code. OPM set the codes in its Guidance for Assigning New Cybersecurity Codes, issued on January 4, 2017. A position gets code 000 when it has no such functions. Otherwise it gets up to three-digit codes from 100 to 999 for its main functions. The NICE Framework Components map each work role to its OPM code. Three newer work roles have no OPM code yet, so they use the closest code until OPM assigns one.

Evidence: the coded position list, the review records, and the yearly code review.

9. Assessing Skills and Workforce Gaps #

Each year, the CISO and the SAOP assess the skills of the covered workforce and find the gaps. The Inspector General rates this work in the FISMA metrics for fiscal year 2025, which stay in effect for fiscal year 2026. Core metric 24 asks whether a skills assessment drives specialized training, and metric 25 rates the training program as a whole. The Federal Cybersecurity Workforce Assessment Act of 2015 required yearly reports of work roles of critical need through 2022. The Organization keeps that yearly review and reports to OPM when OPM asks.

Evidence: the assessment results, the development plans, the gap analysis, the critical role table, and the decision record.

10. Yearly Report #

The CISO and the SAOP report to the CIO and the CHCO each year, before the yearly FISMA report. The report covers:

• completion by role against the completion target, and the overdue, suspension, and extension counts;
• the coding status of cybersecurity positions;
• the skills assessment results and the gaps found;
• the top seven critical work roles, with filled, vacant funded, and emerging-need counts;
• the training and hiring planned for the next year, and its cost;
• changes needed in this plan.

Evidence: the completion report, the yearly report, the submitted CIO FISMA metrics, and any plan revision.

11. Values the Organization Sets #

12. Measures #

13. Recurring Schedule #

14. Records #

• The Security Training Coordinator keeps the training records in the LMS for the retention period above.
• The CISO’s staff keep the role catalog, the approved course list, the gap analyses, and the yearly reports in the document management system.
• Human Resources keeps the position codes in the personnel system.

Evidence: the records above, found by person, role, or fiscal year.

15. Related Documents #

• Awareness and Training Policy (POL-AT) and Procedures (PROC-AT): literacy training and the training rules.
• Program Management Policy (POL-PM): the workforce program and the testing, training, and monitoring plan.
• Rules of Behavior — Privileged Users (ROB-PRIV-001).
• Information Security Continuous Monitoring (ISCM) Strategy (PLAN-ISCM-001): the testing and monitoring parts of the plan that NIST SP 800-53 PM-14 requires.

16. Derived Governance Requirements #

• Develop a plan for information systems security awareness and training. (5 CFR 930.301)
• Identify employees with significant information security responsibilities and give them role-specific training under NIST standards and guidance. (5 CFR 930.301(a))
• Train executives in information security basics and in security planning and management at the policy level. (5 CFR 930.301(a)(2))
• Train staff again after a significant change in the system environment or procedures, or when they enter a position that needs more role-specific training. (5 CFR 930.301(d))
• Have the CISO train and oversee personnel with significant information security responsibilities. (44 U.S.C. 3554(a)(3)(D))
• Keep enough trained personnel to help the Organization comply with FISMA and its policies, procedures, standards, and guidelines. (44 U.S.C. 3554(a)(4))
• Give role-based security and privacy training to employees and contractors with security and privacy roles, including managers, before they get access or take on the duties. (OMB Circular A-130, Appendix I, §4(h)(5))
• Test the knowledge level of information system users. (OMB Circular A-130, Appendix I, §4(h)(4))
• Have the CHCO, CIO, Chief Acquisition Officer, and SAOP set competency requirements for security, privacy, and IT staff, and keep a current workforce planning process. (OMB Circular A-130, §5(c)(1))
• Involve the SAOP in the Organization’s privacy hiring, training, and professional development needs. (OMB Circular A-130, §5(c)(6))
• Identify every position that performs cybersecurity or other cyber-related functions and assign its employment code. (Pub. L. 114-113, div. N, § 303(a))
• Identify the information technology, cybersecurity, and cyber-related work roles of critical need in the workforce. (Pub. L. 114-113, div. N, § 304(a))
• Report the top seven critical cyber work roles by NICE work role ID, with filled positions, funded vacancies, and emerging needs. (FY 2026-2027 CIO FISMA Metrics, CIO-FY26-0100 to CIO-FY26-0106)

17. References #

These are the sources this document cites, with a link to each official text.

• 5 CFR § 930.301: Information Systems Security Awareness Training Program — role-based training for personnel with significant security responsibilities, June 17, 2004.
• Federal Cybersecurity Workforce Assessment Act of 2015 (Pub. L. 114-113, div. N, title III; 5 U.S.C. 301 note), December 18, 2015.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FY 2026-2027 CIO FISMA Metrics, August 3, 2026.
• Guidance for Assigning New Cybersecurity Codes to Positions with Information Technology, Cybersecurity, and Cyber-Related Functions, January 4, 2017.
• NICE Framework Components v2.2.0, April 28, 2026.
• NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program, September 2024.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53A Rev. 5: Assessing Security and Privacy Controls, January 2022.
• NIST SP 800-181 Rev. 1: Workforce Framework for Cybersecurity (NICE Framework), November 2020.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.