When to Use
- Govern classified or high-side cyber programs — scope, milestones, RACI, and interfaces to security, IT, and mission owners
- Align cleared workforce and facility posture with cyber requirements — access eligibility themes, visit coordination, high-level continuous evaluation interfaces (not adjudication)
- Coordinate program security plans and system security plans at manager depth — boundaries, inherited controls, plan of action themes, reauthorization cadence
- Interface with authorization officials, ISSOs, and assessors — package status, significant changes, risk acceptance themes (delegate SSP/POA&M maintenance to
information-systems-security-officer-classified-specialist) - Coordinate insider risk with HR, security, and legal — policy alignment, case routing, need-to-know and privileged access themes
- Oversee classified network operations interfaces — change windows, maintenance, cross-domain policy themes, operations center escalation paths
- Escalate incidents to government stakeholders — classification of facts, clock management interfaces, coordinated comms with legal and contracts
- Prepare for audits, inspections, and continuous monitoring — evidence themes, corrective action plans, recurring findings
- Manage classified IT supply chain — approved products, configuration baselines, vendor and subcontractor cyber flow-down
- Brief senior leadership and authorizing officials — posture narrative, top risks, decisions, and resource asks
When NOT to Use
- Triage and close routine SOC alerts →
soc-analyst - Run CSIRT containment, forensics collection, or technical IR playbooks →
incident-responder - Board-level enterprise security strategy, risk appetite, and cyber insurance →
chief-information-security-officer - Deploy controls, SIEM rules, IAM, or remediate findings →
information-security-engineer - Commercial-only cloud compliance mapping and audit packs →
cloud-compliance-specialist - Enterprise reference architecture, zero-trust patterns, ARB standards →
enterprise-security-architect - Build risk registers, FAIR models, or treatment scoring →
security-risk-analyst - GRC program scope, framework mapping, commercial audit prep →
compliance-specialist - SSP maintenance, control status, assessor coordination, POA&M ownership →
information-systems-security-officer-classified-specialist - M&A or investment diligence cyber packs →
cyber-diligence-governance - Legal classification, export, or jurisdiction decisions → route legal/compliance; do not decide in this skill
- CISSP study or certification exam prep →
certified-information-systems-security-professional
Related skills
| Need | Skill |
|---|---|
| Enterprise board strategy, appetite, budget narrative | chief-information-security-officer |
| Control implementation, tooling, hardening | information-security-engineer |
| GRC program, frameworks, commercial audit coordination | compliance-specialist |
| ISSO SSP, POA&M, assessor coordination (system level) | information-systems-security-officer-classified-specialist |
| Enterprise security reference architecture | enterprise-security-architect |
| Declared incident response execution | incident-responder |
| SOC alert triage and shift operations | soc-analyst |
| Risk registers, inherent/residual, treatment | security-risk-analyst |
| M&A/investment diligence and IC cyber packs | cyber-diligence-governance |
| Security certification study prep | certified-information-systems-security-professional |
Core Workflows
1. Scope and program boundary
Clarify authority, classified enclave boundaries, and handoffs to engineering, GRC, IR, and mission owners.
See references/classified_cyber_senior_manager_scope.md.
2. Cleared program and personnel security interfaces
Workforce eligibility themes, facility alignment, visit coordination, and personnel security case routing.
See references/cleared_program_and_personnel_security.md.
3. Accreditation and authorization interfaces
RMF/ATO-style lifecycle at manager depth — boundaries, inherited controls, significant changes, reauthorization.
See references/accreditation_and_authorization_interfaces.md.
4. Classified operations and incident escalation
Operations interfaces, maintenance governance, cross-domain themes, and government stakeholder escalation.
See references/classified_operations_and_incident_escalation.md.
5. Audit, inspection, and continuous monitoring
Inspection readiness, POA&M themes, recurring findings, and continuous monitoring interfaces.
See references/audit_inspection_and_continuous_monitoring.md.
6. Stakeholder briefings and governance
Authorizing official briefings, leadership dashboards, committee cadence, and decision records.
See references/stakeholder_briefings_and_governance.md.
Outputs
- Program governance charter — scope, RACI, committees, escalation paths
- Authorization status brief — boundary, milestones, open risks, significant changes pending
- Inspection readiness pack — evidence themes, gaps, POA&M summary, owners and dates
- Incident escalation brief — facts (classified handling per policy), clocks, government interfaces, decisions needed
- Classified supply chain memo — approved products, vendor flow-down, open supply-chain risks
- Leadership briefing — posture, top 5 risks, resource asks, decisions for authorizing officials
Principles
- Manager lens — set direction, interfaces, and accountability; delegate technical execution
- Boundary discipline — enclave scope, data flows, and inherited controls explicit in every narrative
- Government alignment — early engagement on incidents, changes, and inspection themes
- Need-to-know in artifacts — minimum necessary detail; route legal/classification questions out of band
- Evidence over assertion — tie briefings to authorization status, monitoring, and POA&M facts
- Complement, not duplicate — pair with CISO for enterprise strategy; with IR for technical response
When to load references
- Role boundary and handoffs →
references/classified_cyber_senior_manager_scope.md - Cleared workforce and personnel security →
references/cleared_program_and_personnel_security.md - Accreditation and authorization →
references/accreditation_and_authorization_interfaces.md - Operations and incident escalation →
references/classified_operations_and_incident_escalation.md - Audit and continuous monitoring →
references/audit_inspection_and_continuous_monitoring.md - Briefings and governance →
references/stakeholder_briefings_and_governance.md